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ECO System Overview 
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Engine Cutoff Sensor System 
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• The ECO sensors operate much like the "gas low" 
warning light in an automobile. When the fuel level drops 
below a sensor, that sensor sends a message to the 
orbiter's computer that it is dry. 

• Orbiter computers poll these sensors about 8-12 
seconds prior to planned Main Engine Cutoff, or MECO, 
which is about 8.5 minutes after launch. 

• If two of the four ECOs transition from ‘wet’ to ‘dry’, 
which means the tank is almost empty, the space shuttle 
main engines will be immediately shut down. If the main 
engines are shut down prior to normal operating time, it 
could affect whether or not the shuttle reaches the 
appropriate orbit. 
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engineering Orbiter ECO Sensor Cable Routinci 


Aft Avionics 
Bay 4 

ECO 3, 4, & 5% 
Cable Routing 


LH2 Orbiter/ET 
Electrical l/F 



Aft Avionics 
Bay 5 

ECO 1 & 2 
Cable Routing 


L02 Orbiter/ET 
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LH2 ECO Circuit Diagram 
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Point Sensor Box Location 


Point Sensor Electronics Box 
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External Tank Connector Locations 
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Liquid Hydrogen ECO System 



The ET’s LH2 sensors include cabling, harnesses, a series of connectors 
and Point Sensor Box (PSB) in the orbiter. 

The sensors in the tank basically consist of a platinum wire and support 
housing. Under cryogenic conditions the sensor’s resistance drops from 
approximately 140 ohms (ambient) to approximately 5 ohms (-423 deg F). 
The PSB provides a constant current source which allows its electronics to 
monitor the voltage drop across each sensor for fuel status. 


There are four ECO sensors 
in the LH2 tank, mounted on 
a single, shock isolated 
carrier plate approximately 
four feet from the bottom of 
the tank. 

There are similar ECO 
sensors on the liquid oxygen 
side that are located in the 
Main Propulsion System 
LOX feed line inside the 
orbiter. 


Overall Schematic of Engine Cutoff 
(ECO) and Liquid Level (Point) Sensors 



FOUR LH 2 ECO 
POINT SENSORS (IN ET) 


POINT SENSOR 
ELECTRONICS BOX 
(ORBITER AVIONICS BAY 5) 
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ET LH2 ECO Sensor Locations 




Sensing Element 


Depletion Sensors 
Mounted on Shock Mount 
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Nominal Test and Checkout 
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Launch Day ECO Sensor Performance 
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• Shortly after propellant loading begins, the LH2 ECO sensors 
transitions from ‘dry’ to ‘wet,’ meaning they are covered with 
cryogenic propellant. Shortly after the 5 percent sensor transitions to 
‘wet’ propellant loading is commanded to Fast Fill and the PSB is 
commanded to a false ‘dry’ state (supplemental voltage test) for the 
LH2 ECO sensors. This configuration allows the PSB to monitor far 
a failed ‘wet’ (open circuit) condition. 

- This configuration keeps the sensors in the loop but tricks the PSB’s 
comparator circuit to output a ‘dry’ indication. Since the sensors are still 
the loop, the PSB will output a ‘wet’ indication if the circuit is interrupted 
(open circuit). 

• This simulated 'dry' configuration is held until just after we enter the 
T-9 minute hold, when the command is removed and the sensors 
are monitored to assure that they are reading 'wet' through the 
remainder of the count. 

• A vehicle modification to monitor each ECO sensor voltage drop is 
also available to assess systems performance. 


04 / 23/2008 


12 



ECO Sensor History 
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History of ECO Sensor Problems 


• Prior to STS-1 14 numerous Liquid Level Sensor anomalies have been 
recorded. It wasn’t until STS-1 14 where multiple ECO sensors were 
affected that a Common Cause concern was generated. Prior anomalies 
were either resolved or unexplained since the External Tank is/was 
unavailable post launch. 

• STS-1 14, (ET-121), July 2005 - During tanking, ECO sensor #4 was 
discovered failed during the supplemental voltage test. During post scrub 
propellant drain, ECO sensor #3 also failed. An exhaustive engineering 
analysis and troubleshooting were performed without any significant 
findings (including an instrumented tanking test). The vehicle was rolled 
back to the VAB and transferred to a second stack. During the next launch 
attempt ECO sensor #2 failed. A 48 hour scrub was initiated to evaluate 
systems performance and test options. Launch occurred on July 26, 2005, 
without any ECO sensor issues. 

• STS-1 21 (ET-1 19), July 2006 - The 5 percent Liquid Level Sensor was 
discovered failed during the supplemental voltage test. This sensor is not 
included in the in-flight Engine Cut-Off determination or criteria. 

• STS-1 16 (ET-1 23), Dec 2006 -- ECO sensor #3 failed ‘wet’ during fast fill. A 
24 hour scrub was initiated and the sensor recovered during drain. No 
sensor failures occurred during the subsequent launch. 
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Recent ECO Sensor Anomalies (STS-122) 
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• The launch of shuttle Atlantis on STS-122 was delayed in December of 
2007 after failures occurred in the fuel sensor system while Atlantis' external 
tank was being prepared for launch. 

- The Dec. 6 launch attempt was postponed after two of the four LH2 tank ECO 
sensors gave false readings. Launch commit criteria requires four of four 
functioning sensors to lift off. A third sensor failed while the tank was drained of 
fuel. Within several hours of the tanking operation, all four ECO circuits returned 
correct readings. 

- On Dec. 9, one of the four LH2 ECO sensors gave a false reading, causing the 
launch to be postponed for the second time. 
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Troubleshooting Plan 
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Troubleshooting Plan 
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• Instrumented Tanking Test 

Getting to the bottom of this anomaly was deemed 
critical to the future of the Program 

• Requirements 

- Quick Turnaround 

• Minimize impact on Shuttle mission objectives 

- Systems Characterization 

• Identifying TDR responses to harness characteristics in 
advance was critical 

- Failure Repeatability 

• Previous anomalies did not consistently repeat during 
subsequent tankings 

• However, the number of anomalies observed thus far for 
STS-122 yielded a high probability of capturing one during 
the tanking test. 
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ECO System Characterization 
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• Characterization 

- Fabrication and characterization of like 100 ft test cable. 

• Multiple TDR tests were performed in the lab to capture multiple 
cable configurations and responses. 

- Test like External Tank 

• Multiple TDR tests were performed in the VAB on ET-126 utilizing 
the 100 ft Test Cable capturing the combined ambient responses. 

- Testing under Cryo 

• Multiple TDR tests were performed at KSC’s Cryo Lab utilizing the 
100 ft Test Cable, an External ET Cable, Feedthru Connector, an 
Internal Cable, and Sensors to capture multiple cable configurations 
and responses in a Cryo environment. 

• Summary: 

System characterization responses were determined to 
be extremely consistent providing a high degree of 
confidence in the tests ability to localize any defect 
during the Tanking Test. 
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Test Cable Routing and Setup 


• View of MLP and Room 33A 



50-2 Access Door 

L02 Tail Service Mask (TSM) 

Test Cable Routing to 33A 
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LH2 ECO System Wiring Diagram 
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Going Forward Plan 
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• A tanking, or fueling, test at Kennedy on Dec. 18, 2007, revealed that 
open circuits in the external tank's external electrical feed through 
connector were the most likely cause of false readings in the ECO 
sensor system during launch attempts on Dec. 6 and Dec. 9. NASA 
formed a combined troubleshooting team involving multiple NASA 
centers to find the root cause and develop plans to fix the system. A 
parallel team also was established to develop a forward plan of 
action to support the earliest possible launches STS-122 and STS- 
128 

■ ^ ■ EC0 1 & EC02 TDR Data , Tanki ng Test 1 2/1 8/07 



EC03 TDR Data , Tanki ng Test 1 2/1 8/07 



04 / 23/2008 


21 



Identifying Root Cause 
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Root Cause Analysis 


• All circuit anomalies experienced during testing were able to be repeated as 
seen during the two launch attempts and tanking test. 

• Open circuits in the part that connects wires from the interior to the exterior 
of the liquid hydrogen tank, commonly known as the feed through plate, 
were identified as the culprit that caused false readings during two launch 
attempts and a tanking test in December 2007. 

• The external plug and feed through connector were removed from the tank 
and shipped to Marshall Space Flight Center in Alabama to determine 
whether the failure could be recreated in a test facility using focused and 
limited nondestructive and destructive physical tests. The tests were 
configured to replicate tank chill down temperatures, loading pressures and 
environmental conditions during the two launch attempts. 
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Root Cause Analysis 
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• Additional testing at KSC Cryo Lab determined Liquid air / moisture 
combined with Krytox® and/or silicon oil residue can create a layer 
of frost under cryogenic conditions allowing for intermittent open 
circuits to form as subtle movements (thermal contractions) of the 
External Tanks external feed thru connector. 

• Minute amounts of Krytox® and silicon were found on the external 
connector. 

• The external connector is exposed to air and humidity while the 
internal connector is enclosed in the Helium purged LH2 tank. 



Contamination 



Socket 
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Test Apparatus Design & Objectives 
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Objective is to contaminate pin 
(varying levels of 
contamination), insert into 
socket at ambient temperature 
then lower the mated 
pin/socket assembly into LN 2 
bath then in a controlled 
fashion move the pin in/out of 
the socket while measuring 
the displacement and 
monitoring electrical 
characteristics. 

Electrical characteristics 
monitored via Nicolet. 

Data objectives: 

1. Correlate anomalous electrical 
behavior to level of 
contamination. 

2 . Determine socket architecture 
affects if any (leaf spring vs. 
split tine). 

3 . Improve understanding of 
displacement required to get 
measurable electrical change. 

4 . E94^MflQ£H&racteristics of 
hard open (precursor 

hfiha\/iniA 



AJUSTMENT KNOB 


DIAL INDICATOR 


LINEAR RAIL 


KSC Prototype Lab - Final Design 
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Electrical Characterization 
Resistance 
Current 
Voltage 

Ambient Temperature 

Wires are secured to the 

Cryogenic Wire Displacement 
Apparatus unmated. 

Wires are connected to Nicolet. 

Pin and socket are mated to a 
160 mil nominal insertion. 

Cryogenic Temperature 

Pin/socket assembly then cooled 
in LN2 for 1 to 3 minutes. 

Wires are displaced out/in 
monitoring electrical data and 
displacement. 

Anomalous electrical behavior 
and opens are noted with re- 
spect to displacement and 
contaminant condition (i.e. 
Krytox®, water, frost, Krytox®/ 
water, or baseline/clean). 
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Test Apparatus Actual & Procedure 



Tested on 2/2/2008 


Cryogenic Wire 
Displacement Apparatus 


Nicolet Electrical High 
Speed Data Recorder 


Krytox®/water contamination is achieved by cooling engaged pin/socket in LN2 
for 3 minutes then removing from LN2 and allowing frost/condensate to form 
engaged or disengaged or a combination thereof. Pin/socket is engaged 160 
mils then placed back into LN2 for at least 3 minutes before displacement. 
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Test Apparatus Actual & Preliminary Results 
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Preliminary Results on Internal Double Tine Sockets 


Baseline (4)* 

No noise, no opens 


Krvtox® 240 AC Grease and Krvtox® 143 AC (>6)* 
No noise (1 instance of min noise), no opens 


Frost / Condensate (4)* 

Some noise, one short transient open 

Krvtox® / Water (2)* 

Noise precursor, mostly open (required about 1 
3 mils to initiate open) 
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Preliminary Results - test file 26 hard open 
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Preliminary Results - test file 26 hard open 
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Preliminary Results - test file 3 noise 
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Preliminary Results - test file 3 noise 
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Preliminary Results - test file 12 
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Krytox® 240AC/Frost/Moisture on Socket/Pin 
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Frost formation on Krytox® 240 AC coated pin/socket after immersion in LN2 for at 
least 3 minutes beginning to melt. 


One of the methods used to introduce moisture into pin/socket before test. 
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Moisture Micrographs clean pin vs. Krytox® pin 
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Preliminary Summary 
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• “Clean” pin/sockets experienced no anomalous electrical behavior 
or opens when displaced in LN2. 

• Water (frost/condensate) contaminated pin/sockets experienced 
some anomalous electrical behavior and one short transient open 
when displaced in LN2 

• Krytox® (grease/oil) contaminated pin/sockets experienced no 
anomalous electrical behavior or opens when displaced in LN2. 

• Krytox® 240 AC (grease) / water contaminated pin/sockets 
experienced a great deal of anomalous behavior and was mostly 
open when displaced in LN2. Krytox® 143 AC (oil) not run yet. 

- Krytox® 240 AC / water contaminated pin/sockets were heavily 
contaminated with Krytox®. 
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Preliminary Summary 
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• Similar electrical behavior may be measured between other 
hydrophobic contaminants and water (i.e. silicone oil or organics). 

• Anomalous electrical behavior and opens required cold and 
displacement. 

• Electrical circuit reestablishes itself (open circuit closes) after the 
pin/socket system is removed from LN2. 
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Implications to Shuttle/ET 
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• Preliminary test data supports flight rationale 

- Internal connector is in a purged environment prior to loading (no 
moisture present). 

- Internal connector has limited contamination in comparison to gross 
contamination of single pin/socket tests run to date. 

• Supports root cause 

- Indicates a combination of contaminants may be required to increase 
the likelihood of experiencing anomalous electrical behavior and open 
circuits. 

- Displacement/movement and cold temperature is required for 
anomalous electrical behavior and to open circuit. 
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Redesign 
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Going Forward Plan 


ksc yr 

ENGINEERING 

• A modified connector was designed with the pins and sockets 
soldered together. A similar, but slightly redesigned connector was 
to be used. Both the original and modified connector configurations 
were subjected to temperature, pressure and vibration environments 
identical to those experienced during a shuttle launch. The tests 
verified the adequacy of the new configuration. 
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Conclusion 
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LH2 ECO Conclusion 
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• Conclusion 

- Liquid air / moisture combined with Krytox® and/or silicon oil 
residue can create a layer of frost under cryogenic conditions 
allowing for intermittent open circuits to form as subtle 
movements (thermal contractions) of the External Tank’s 
external feed thru connector. 

• Resolution 

- Solder the ten pin/socket connections (Four ECO and one 5 
percent, both Hi and Low). 

• System Improvements 

- Improved Tolerances on Sensors 

- Redundancy Routing / Separation 

- Voltage Monitoring Mod 

- Soldered Connections at the ET Feedthru External Connector 
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